CVE-2025-54806

Medium · 6.1

CVSS

6.1

EPSS

0.2%

Published

Oct 23, 2025

CISA due date

—

The record

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

Affected packages

Ecosystem	Package	Introduced	Fixed